Nine Things You Should Do When Skimming Strikes
INDIANAPOLIS — Sandra Morgenstern, president of Par Mar Oil Co. and a 2015 Convenience Store News Woman of the Year, was a victim of credit card and debit card skimming at the pump at her 50-store chain based in Marietta, Ohio.
She is certainly not alone. As highlighted during an educational session that took place March 24 at M-PACT 2016, a regional trade show covering the states of Ohio, Kentucky, Illinois and Indiana, more and more retailers are being confronted with this predicament.
Morgenstern introduced "Skimming the Surface" session presenter Chris Ingram, an attorney with Vorys, Sater, Seymour and Pease LLP, who started off by pointing out that with an estimated 29 million Americans paying for gasoline with a debit card or credit card at the pump every day, skimming will not go away anytime soon.
Skimmers are devices criminals use in an attempt to steal customer card information. C-stores located near interstate highways are most vulnerable to skimming crime rings, according to Ingram.
“You can purchase skimming devices on the Internet,” he said. “And with so many different varieties of skimmers, the sky is the limit.”
To make matters worse, criminals can install skimmers in just seconds and now have the ability to steal customer information via Bluetooth or text technology, as opposed to needing to return to the gas station dispenser to remove the illegal device once the information has been captured.
If a c-store operator has been the victim of a skimming incident, Ingram said they should follow a nine-step protocol:
1. Close the pump
2. Do not touch the device
3. Contact law enforcement
4. Contact legal counsel
5. Preserve relevant security footage
6. Document actions taken by the retailer
7. Review contracts for notice obligations
8. Notify your insurer, if applicable
9. Notify affected individuals.
Forty-seven states have notice of breach laws. Alabama, South Dakota and New Mexico are the exceptions. Laws vary by state, and several charge financial penalties for retailers who do not notify affected individuals of a breach.
To prevent further skimming incidents, Ingram recommended c-store retailers take the following steps: change to unique locks; install anti-tamper devices; install security cameras; use customized anti-tamper tape; train associates; and establish an inspection protocol.
In regards to training associates, the attorney explained that c-store operators can take any number of steps, such as providing photos of what both normal dispensers and dispensers with skimmers look like, as well ensuring inspection logs are completed.
M-PACT 2016 took place at the Indiana Convention Center in Indianapolis March 23-24. The annual spring event bills itself as the largest gathering place in the Midwest for energy and convenience industry leaders.